ccmsetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ccmsetup.exe
Size

6.5MB
MD5

c16b13d6c8762c707720be0fa08692cf
SHA1

1c9adf109da91cb23690796d68d4474423849af7
SHA256

26b945aeeab63ad9fcfb24b6e54391a943892b26900d3c30b35ef49ff5f24e2a
SHA512

9b7d95871112c848bbcdde5878823957f809a049b12e7120a2b521b348cc2c98aaee0d6793e1cc79454610cbacd7a237a3700d6299145edef04065bbc6a71639
SSDEEP

49152:fptcd+xirMx2wXPVJsTa3AIqV0hhEmTcybUdvlOlg9E/2L5U8En6SaHpnBARDHnY:fDcdLrMx2wXPVJsTaQIQohEmTS

Score

1^/10

Malware Config

Signatures

Files

ccmsetup.exe
.exe windows:6 windows x86 arch:x86

db1ccf062e38e71227cec61da271b47d

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:7b:14:c0:b8:35:69:fc:29:48:80:de:05:8f:93:ca:88:8a:6a:62:8f:88:88:2c:d3:66:7d:f7:66:1a:78:7b
Signer

Actual PE Digest

6f:7b:14:c0:b8:35:69:fc:29:48:80:de:05:8f:93:ca:88:8a:6a:62:8f:88:88:2c:d3:66:7d:f7:66:1a:78:7b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

K:\dbs\sh\cmgm\1026_005344\cmd\1f\out\retail-i386\ccmsetup\ccmsetup.pdb

Imports

kernel32

VirtualFree
DecodePointer
GetLocalTime
GetComputerNameExW
GetDiskFreeSpaceW
VirtualAlloc
FileTimeToSystemTime
TerminateProcess
OpenProcess
GetProcessTimes
GetComputerNameW
SystemTimeToFileTime
IsDebuggerPresent
OutputDebugStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetSystemTime
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
GetCurrentThread
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetProcessHeap
SetConsoleCtrlHandler
SetStdHandle
GetStringTypeW
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
WriteConsoleW
lstrcmpW
GlobalLock
GlobalUnlock
FormatMessageW
GetThreadTimes
GetTimeZoneInformation
SetErrorMode
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
SetFilePointer
LockFileEx
SetEndOfFile
UnlockFileEx
FileTimeToLocalFileTime
GetVolumeInformationW
GetFileAttributesExW
DeviceIoControl
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
GetSystemInfo
GetCurrentDirectoryW
LocalAlloc
GlobalFree
DuplicateHandle
WTSGetActiveConsoleSessionId
HeapCreate
HeapQueryInformation
HeapSetInformation
HeapDestroy
CreateSemaphoreW
ReleaseSemaphore
FreeConsole
AllocConsole
GetConsoleWindow
PeekNamedPipe
GetVersion
CreatePipe
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
WaitForMultipleObjects
TerminateJobObject
OpenEventW
CreateFileMappingW
CompareFileTime
GetSystemDefaultLCID
GetExitCodeThread
CreateThread
SleepEx
OpenMutexW
VirtualProtect
VirtualQuery
LoadLibraryExA
SetLastError
LoadLibraryW
GetDiskFreeSpaceExW
GetSystemDefaultUILanguage
ExpandEnvironmentStringsW
GetExitCodeProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetFullPathNameW
FindClose
GetCurrentProcess
WritePrivateProfileStringW
MoveFileExW
GetTempFileNameW
GetCurrentProcessId
GetEnvironmentVariableW
GetFileSize
GetSystemPowerStatus
GetTickCount
CreateDirectoryW
GetPrivateProfileIntW
RemoveDirectoryW
CopyFileW
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerW
CopyFileExW
SetFileAttributesW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WriteFile
ReadFile
GetFileSizeEx
CreateFileW
GetFileAttributesW
MapViewOfFile
LocalFree
CreateProcessW
Sleep
ResetEvent
GetCommandLineW
SetEvent
ReleaseMutex
WaitForSingleObject
lstrlenW
FindNextFileW
DeleteFileW
FindFirstFileW
UnmapViewOfFile
CreateEventW
CreateMutexW
InitializeCriticalSection
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionEx
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
GetModuleHandleW
GetProcAddress
FreeLibrary
GetCurrentThreadId

user32

CharUpperBuffW
MessageBoxW
GetDesktopWindow
CharNextA
ShowWindow
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
LoadStringW
DefWindowProcW
DestroyWindow
CreateWindowExW
RegisterClassW
LoadCursorW
GetSystemMetrics
CharLowerBuffW
CharNextW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptDestroyKey
CryptAcquireContextW
CryptVerifySignatureW
CryptCreateHash
CryptHashData
CryptSetHashParam
CryptDestroyHash
CryptImportKey
CryptSignHashW
CryptGetHashParam
CryptReleaseContext
EventWrite
EventRegister
EventUnregister
LsaClose
LsaFreeMemory
GetWindowsAccountDomainSid
LsaQueryInformationPolicy
LsaNtStatusToWinError
LsaOpenPolicy
QueryServiceConfigW
EnumDependentServicesW
RegQueryValueExW
QueryServiceStatusEx
EqualSid
GetTokenInformation
ConvertSidToStringSidW
ConvertStringSidToSidW
CreateProcessAsUserW
DuplicateTokenEx
IsTextUnicode
RevertToSelf
ImpersonateLoggedOnUser
OpenThreadToken
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
InitializeAcl
GetAclInformation
GetAce
AddAce
IsValidAcl
SetSecurityDescriptorSacl
GetSecurityDescriptorOwner
StartServiceW
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetLengthSid
CopySid
SetSecurityDescriptorGroup
GetSecurityDescriptorControl
SetSecurityDescriptorControl
IsValidSecurityDescriptor
ImpersonateSelf
CloseServiceHandle
InitiateSystemShutdownExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegisterServiceCtrlHandlerExW
RegSetKeySecurity
ChangeServiceConfigW
ChangeServiceConfig2W
SetNamedSecurityInfoW
DeleteService
ControlService
QueryServiceStatus
SetServiceStatus
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetUserNameW
StartServiceCtrlDispatcherW
OpenSCManagerW
CreateServiceW
OpenServiceW

shell32

CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CLSIDFromString
CoTaskMemAlloc
CoTaskMemRealloc
CLSIDFromProgID
CoCreateGuid
CreateStreamOnHGlobal
GetHGlobalFromStream
StringFromGUID2
CoQueryProxyBlanket
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles

oleaut32

VariantInit
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VariantTimeToSystemTime
SafeArrayDestroy
SafeArrayCreateVectorEx
SafeArrayGetVartype
SafeArrayGetElement
SafeArrayPutElement
SysAllocString
SysAllocStringLen
VariantCopy
VariantClear
SysFreeString
SysStringLen
VarUI4FromStr

crypt32

CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertFindCertificateInStore
CertAddEncodedCertificateToStore
CertCloseStore
CertVerifyCertificateChainPolicy
CertCompareCertificateName
CertStrToNameW
CertGetNameStringW
CertFreeCertificateChain
CryptVerifyCertificateSignatureEx
CertNameToStrW
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertVerifyTimeValidity
CertGetValidUsages
CertGetCertificateChain
CertFindChainInStore
CryptDecodeObjectEx
CryptDecodeObject
CryptAcquireCertificatePrivateKey
CertCreateCertificateContext
CertControlStore
CertFreeCertificateChainEngine
CryptProtectData
CryptUnprotectData
CertFindExtension

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winhttp

WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpConnect
WinHttpQueryOption
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

psapi

EnumProcessModules
GetModuleFileNameExW

setupapi

SetupIterateCabinetW

shlwapi

PathIsUNCServerShareW
PathFindFileNameW
SHDeleteKeyW
AssocQueryStringW
PathCombineW
PathSkipRootW
PathFindExtensionW
PathCanonicalizeW
PathAddBackslashW
PathAppendW
PathIsRelativeW
PathIsNetworkPathW
PathStripToRootW

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

netapi32

DsGetSiteNameW
NetApiBufferFree

activeds

ord4
ord9
ord5
ord6

ws2_32

inet_ntoa
htonl
inet_addr

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db1ccf062e38e71227cec61da271b47d

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

6f:7b:14:c0:b8:35:69:fc:29:48:80:de:05:8f:93:ca:88:8a:6a:62:8f:88:88:2c:d3:66:7d:f7:66:1a:78:7bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

version

winhttp

rpcrt4

psapi

setupapi

shlwapi

wtsapi32

iphlpapi

netapi32

activeds

ws2_32

wintrust

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 5.0MB - Virtual size: 5.0MB

.data Size: 41KB - Virtual size: 47KB

.didat Size: 512B - Virtual size: 76B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 132KB - Virtual size: 131KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

6f:7b:14:c0:b8:35:69:fc:29:48:80:de:05:8f:93:ca:88:8a:6a:62:8f:88:88:2c:d3:66:7d:f7:66:1a:78:7b
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 5.0MB - Virtual size: 5.0MB

.data
Size: 41KB - Virtual size: 47KB

.didat
Size: 512B - Virtual size: 76B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 132KB - Virtual size: 131KB